Mariusz Felisiak f944f79e55 [3.2.x] Fixed CVE-2021-3281 -- Fixed potential directory-traversal via archive.extract(). ...

Thanks Florian Apolloner, Shai Berger, and Simon Charette for reviews.

Thanks Wang Baohua for the report.

Backport of 05413afa8c18cdb978fcdf470e09f7a12b234a23 from master.

2021-02-01 09:13:37 +01:00

..

archives

Fixed #30160 -- Added support for LZMA and XZ templates to startapp/startproject management commands.

2019-07-31 10:02:13 +02:00

eggs

…

files

Fixed #31080 -- Removed redundant type="text/javascript" attribute from <script> tags.

2019-12-11 09:49:54 +01:00

test_module

Fixed #32314 -- Fixed detection when started non-django modules with "python -m" in autoreloader.

2021-01-05 21:03:29 +01:00

traversal_archives

[3.2.x] Fixed CVE-2021-3281 -- Fixed potential directory-traversal via archive.extract().

2021-02-01 09:13:37 +01:00

__init__.py

…

models.py

Refs #20094 -- Removed obsolete tests/utils_tests/test_itercompat.py

2017-04-26 10:54:06 -04:00

test_archive.py

[3.2.x] Fixed CVE-2021-3281 -- Fixed potential directory-traversal via archive.extract().

2021-02-01 09:13:37 +01:00

test_autoreload.py

Fixed #32314 -- Fixed detection when started non-django modules with "python -m" in autoreloader.

2021-01-05 21:03:29 +01:00

test_baseconv.py

Refs #28909 -- Simplifed code using unpacking generalizations.

2018-09-28 09:57:12 -04:00

test_connection.py

Fixed #32233 -- Cleaned-up duplicate connection functionality.

2020-12-08 08:55:44 +01:00

test_crypto.py

Fixed #31359 -- Deprecated get_random_string() calls without an explicit length.

2020-03-11 13:16:44 +01:00

test_datastructures.py

Updated MultiValueDict.update() to mirror dict.update() behavior.

2020-10-30 10:44:44 +01:00

test_dateformat.py

Simplified TimeFormat.g().

2020-11-12 15:19:17 +01:00

test_dateparse.py

Fixed #32269 -- Fixed parse_duration() for negative days in ISO 8601 format.

2020-12-21 10:28:07 +01:00

test_datetime_safe.py

Refs #29600 -- Updated django.utils.datetime_safe now that Python 2 is unsupported.

2018-08-02 10:20:24 -04:00

test_decorators.py

Refs #26601 -- Deprecated passing None as get_response arg to middleware classes.

2020-02-18 20:03:44 +01:00

test_duration.py

Fixed #28926 -- Fixed loss of precision of big DurationField values on SQLite and MySQL.

2017-12-28 17:35:41 -05:00

test_encoding_deprecations.py

Refs #27753 -- Deprecated django.utils.encoding.force_text() and smart_text().

2019-02-06 14:12:06 -05:00

test_encoding.py

Refs #28428 -- Made filepath_to_uri() support pathlib.Path.

2019-10-30 13:13:15 +01:00

test_feedgenerator.py

Switched TestCase to SimpleTestCase where possible in Django's tests.

2018-11-27 08:58:44 -05:00

test_functional.py

Fixed #32208 -- Allowed adding lazy() objects.

2020-12-21 09:24:41 +01:00

test_hashable.py

Refs #29838, Refs #28507 -- Made make_hashable() ignore key order.

2020-10-05 20:42:46 +02:00

test_html.py

Fixed CVE-2019-14233 -- Prevented excessive HTMLParser recursion in strip_tags() when handling incomplete HTML entities.

2019-08-01 09:24:54 +02:00

test_http.py

Refs #21231 -- Backport urllib.parse.parse_qsl() from Python 3.8.

2020-09-03 14:24:42 +02:00

test_inspect.py

Increased test coverage of django.utils.inspect.

2019-12-27 10:08:24 +01:00

test_ipv6.py

Refs #23919 -- Removed encoding preambles and future imports

2017-01-18 09:55:19 +01:00

test_jslex.py

Fixed E128, E741 flake8 warnings.

2020-05-12 08:52:23 +02:00

test_lazyobject.py

Fixed #29772 -- Made LazyObject proxy __lt__() and __gt__().

2018-09-19 13:51:01 -04:00

test_lorem_ipsum.py

Fixed #28306 -- Completed test coverage for django.utils.lorem_ipsum.

2017-09-02 15:50:43 -04:00

test_module_loading.py

Switched TestCase to SimpleTestCase where possible in Django's tests.

2018-11-27 08:58:44 -05:00

test_no_submodule.py

…

test_numberformat.py

Fixed #28280 -- Prevented numberformat.format() from formatting large/tiny floats in scientific notation.

2020-02-26 16:02:53 +01:00

test_os_utils.py

Refs #30461 -- Added django.utils._os.to_path().

2019-08-13 17:17:39 +02:00

test_regex_helper.py

Refs #27648 -- Removed support for (iLmsu) regex groups in url() patterns.

2017-09-22 12:51:18 -04:00

test_safestring.py

Refs #30573 -- Rephrased "Of Course" and "Obvious(ly)" in documentation and comments.

2020-05-04 12:10:47 +02:00

test_simplelazyobject.py

Refs #23919 -- Removed misc references to Python 2.

2017-01-21 20:02:00 -05:00

test_termcolors.py

Completed test coverage for colorize().

2020-07-29 07:57:06 +02:00

test_text.py

Refs #27804 -- Used subTest() in tests.utils_tests.test_text.

2020-06-04 11:16:21 +02:00

test_timesince.py

Fixed #31623 -- Allowed specifying number of adjacent time units in timesince()/timeuntil().

2020-07-16 09:44:28 +02:00

test_timezone.py

[3.2.x] Refs #32365 -- Allowed use of non-pytz timezone implementations.

2021-01-19 12:00:40 +01:00

test_topological_sort.py

Refs #30179 -- Moved topological sort functions to django.utils.

2019-02-25 15:44:49 -05:00

test_tree.py

Fixed #29838 -- Fixed crash when combining Q objects with __in lookups and lists.

2018-10-17 11:34:49 -04:00

utils.py

Fixed #30366 -- Skipped StatReloaderTests on HFS+ filesystems.

2019-04-24 15:28:20 +02:00